mirror of
https://github.com/opnsense/src.git
synced 2026-06-04 22:32:43 -04:00
28fcfebdaf
ng_btsocket_hci_raw_send() wasn't verifying that the destination address
specified by sendto() is large enough to fill a struct sockaddr_hci.
Thus, when copying the socket address into an mbuf,
ng_btsocket_hci_raw_send() may read past the end of the input sockaddr
while copying.
In practice this is effectively harmless since
ng_btsocket_hci_raw_output() only uses the address to identify a
netgraph node.
Reported by: Oliver Sieber <oliver@secfault-security.com>
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
(cherry picked from commit
|
||
|---|---|---|
| .. | ||
| ng_btsocket.c | ||
| ng_btsocket_hci_raw.c | ||
| ng_btsocket_l2cap.c | ||
| ng_btsocket_l2cap_raw.c | ||
| ng_btsocket_rfcomm.c | ||
| ng_btsocket_sco.c | ||
| TODO | ||